CVE-2021-39697 is a local escalation of privilege vulnerability affecting Google Android versions 11 and 12, stemming from a missing permission check in the DownloadProvider component that allows bypassing external storage protections. Rated as High severity with a CVSS score of 7.8, this flaw enables a local attacker with low privileges to compromise system confidentiality, integrity, and availability without requiring user interaction. Intelligence sources currently indicate no active exploitation, public proof-of-concept code, or significant community discussion regarding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
11.0CPE matchmatch criteria | cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* | ||
12.0CPE matchmatch criteria | cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.